CVE-2026-34046

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34046", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T15:29:04.745Z", "datePublished": "2026-03-27T20:06:35.836Z", "dateUpdated": "2026-11-03T22:13:23.542Z"}, "containers": {"cna": {"title": "Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-8c4j-f57c-35cf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-8c4j-f57c-35cf"}, {"name": "https://github.com/langflow-ai/langflow/pull/8956", "tags": ["x_refsource_MISC"], "url": "https://github.com/langflow-ai/langflow/pull/8956"}], "affected": [{"vendor": "langflow-ai", "product": "langflow", "versions": [{"version": "< 1.5.1", "status": "affected"}]}, {"vendor": "langflow-ai", "product": "langflow-base", "versions": [{"version": "< 0.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T20:06:35.836Z"}, "descriptions": [{"lang": "en", "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `AUTO_LOGIN` was `False` (i.e., authentication was enabled), neither branch enforced an ownership check \u2014 the query returned any flow matching the given UUID regardless of who owned it. This allowed any authenticated user to read any other user's flow, including embedded plaintext API keys; modify the logic of another user's AI agents, and/or delete flows belonging to other users. The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with `user_id = NULL`) under auto-login mode, but inadvertently left the authenticated path without an ownership filter. The fix in version 1.5.1 removes the `AUTO_LOGIN` conditional entirely and unconditionally scopes the query to the requesting user."}], "source": {"advisory": "GHSA-8c4j-f57c-35cf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34046", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T03:55:32.707328Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:13:23.542Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34046", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T03:55:32.707328Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T13:57:14.353Z"}}], "cna": {"title": "Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check", "source": {"advisory": "GHSA-8c4j-f57c-35cf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "langflow-ai", "product": "langflow", "versions": [{"status": "affected", "version": "< 1.5.1"}]}, {"vendor": "langflow-ai", "product": "langflow-base", "versions": [{"status": "affected", "version": "< 0.5.1"}]}], "references": [{"url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-8c4j-f57c-35cf", "name": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-8c4j-f57c-35cf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/langflow-ai/langflow/pull/8956", "name": "https://github.com/langflow-ai/langflow/pull/8956", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `AUTO_LOGIN` was `False` (i.e., authentication was enabled), neither branch enforced an ownership check \u2014 the query returned any flow matching the given UUID regardless of who owned it. This allowed any authenticated user to read any other user's flow, including embedded plaintext API keys; modify the logic of another user's AI agents, and/or delete flows belonging to other users. The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with `user_id = NULL`) under auto-login mode, but inadvertently left the authenticated path without an ownership filter. The fix in version 1.5.1 removes the `AUTO_LOGIN` conditional entirely and unconditionally scopes the query to the requesting user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T20:06:35.836Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34046", "state": "PUBLISHED", "dateUpdated": "2026-11-03T22:13:23.542Z", "dateReserved": "2026-03-25T15:29:04.745Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-27T20:06:35.836Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "langflow", "vendor": "langflow-ai", "versions": [{"status": "affected", "version": "< 1.5.1"}]}, {"product": "langflow-base", "vendor": "langflow-ai", "versions": [{"status": "affected", "version": "< 0.5.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2B9A67D-F960-425C-B4EB-99EC59D6B425", "versionEndExcluding": "1.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:langflow:langflow:1.5.0:dev0:*:*:*:*:*:*", "matchCriteriaId": "433E1411-65A6-4938-B8EE-983C07145FC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:langflow:langflow:1.5.0:dev1:*:*:*:*:*:*", "matchCriteriaId": "85F6671F-A02B-4B74-AA22-09EA710B7130", "vulnerable": true}, {"criteria": "cpe:2.3:a:langflow:langflow-base:*:*:*:*:*:python:*:*", "matchCriteriaId": "C364A228-0EEC-47C5-90A8-07A12DCF48D7", "versionEndExcluding": "0.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `AUTO_LOGIN` was `False` (i.e., authentication was enabled), neither branch enforced an ownership check \u2014 the query returned any flow matching the given UUID regardless of who owned it. This allowed any authenticated user to read any other user's flow, including embedded plaintext API keys; modify the logic of another user's AI agents, and/or delete flows belonging to other users. The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with `user_id = NULL`) under auto-login mode, but inadvertently left the authenticated path without an ownership filter. The fix in version 1.5.1 removes the `AUTO_LOGIN` conditional entirely and unconditionally scopes the query to the requesting user."}, {"lang": "es", "value": "Langflow es una herramienta para construir y desplegar agentes y flujos de trabajo impulsados por IA. Antes de la versi\u00f3n 1.5.1, el asistente \u2019_read_flow\u2019 en \u2019src/backend/base/langflow/api/v1/flows.py\u2019 se bifurcaba en la configuraci\u00f3n \u2019AUTO_LOGIN\u2019 para decidir si filtrar por \u2019user_id\u2019. Cuando \u2019AUTO_LOGIN\u2019 era \u2019False\u2019 (es decir, la autenticaci\u00f3n estaba habilitada), ninguna rama aplicaba una verificaci\u00f3n de propiedad - la consulta devolv\u00eda cualquier flujo que coincidiera con el UUID dado, independientemente de qui\u00e9n lo poseyera. Esto permit\u00eda a cualquier usuario autenticado leer el flujo de cualquier otro usuario, incluyendo claves API de texto plano incrustadas; modificar la l\u00f3gica de los agentes de IA de otro usuario, y/o eliminar flujos pertenecientes a otros usuarios. La vulnerabilidad fue introducida por la l\u00f3gica condicional que estaba destinada a acomodar flujos p\u00fablicos/de ejemplo (aquellos con \u2019user_id = NULL\u2019) bajo el modo de inicio de sesi\u00f3n autom\u00e1tico, pero inadvertidamente dej\u00f3 la ruta autenticada sin un filtro de propiedad. La correcci\u00f3n en la versi\u00f3n 1.5.1 elimina la condicional \u2019AUTO_LOGIN\u2019 por completo y limita incondicionalmente la consulta al usuario solicitante."}], "id": "CVE-2026-34046", "lastModified": "2026-11-03T23:17:42.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34046", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T03:55:32.707328Z", "version": "2.0.3"}}]}, "published": "2026-03-27T21:17:27.753", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/langflow-ai/langflow/pull/8956"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-8c4j-f57c-35cf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.5.1)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "langflow", "source": "cna", "vendor": "langflow-ai"}, "product": "langflow", "vendor": "langflow"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.5.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "langflow-base", "vendor": "langflow"}], "analysis": {"en": {"generated_at": "2026-03-27T21:35:14.850254+00:00", "value": {"mitigation_remediation": ["Upgrade Langflow to version 1.5.1 or later, which removes the faulty auto\u2011login conditional and enforces ownership checks."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of Langflow prior to version 1.5.1, including the langflow and langflow-base packages distributed by langflow\u2011ai. Users running those versions are at risk until they apply the fix.", "description_and_impact": "An authentication bypass in Langflow allows any logged\u2011in user to read, modify, or delete any other user's flow because the code that should restrict access by user ID was omitted when the application was not set to auto\u2011login. The attacker can obtain confidential information such as embedded plaintext API keys, alter AI agent logic, or delete valuable workflows. This represents a direct violation of integrity and confidentiality controls.", "risk_and_exploitability": "With a CVSS score of 8.7, the flaw is classified as high severity. No EPSS score is available, and the issue is not listed in the KEV catalog, suggesting it has not yet been widely exploited. Attackers must be authenticated, implying that any user credential can be abused. Once inside the system, the attacker has unrestricted access to other users' flows without additional privileges, making the exploit straightforward for anyone who can log into the application."}}}}, "created": "2026-03-29T20:30:12.743360+00:00", "updated": "2026-03-30T07:59:25.930099+00:00", "vendors": ["langflow", "langflow$PRODUCT$langflow", "langflow$PRODUCT$langflow-base"]}